Attackers took over Microsoft's official X account, which has more than 13 million followers, and used it to promote a cryptocurrency token named after Clippy, the paper clip assistant from older versions of Microsoft Office, BleepingComputer reported Friday. Microsoft said it has regained control of the account, deleted the posts and is investigating how the breach happened.

What Happened

From the hijacked @Microsoft account, the attackers followed and reposted content from @clippymsftcto, an account impersonating Clippy. That account has since been suspended by X. The posts pushed a token called $Clippy, a setup BleepingComputer described as a pump-and-dump scheme, in which promoters hype a thinly traded token so they can sell into the buying.

A second account, @ClippyMSFT, also promoted the token and falsely claimed that it had a liquidity pool paired directly with Microsoft's stock ticker, MSFT. That account was still active when BleepingComputer published its report.

RelatedDealership IT Vendor Reports Attack Surge, Says MFA Was in Place When Logins Were Stolen

A Microsoft spokesperson confirmed unauthorized access to the company's X account, including posts that did not come from Microsoft. In a statement, the company apologized and said it "does not endorse or have any affiliation with this token," its creators or any related crypto project. Microsoft said it plans to pursue legal action over unauthorized use of the Clippy brand and its other intellectual property.

Why It Matters

A verified corporate handle with millions of followers gives a scam token instant reach and borrowed credibility, which is why brand and government accounts are repeatedly targeted for crypto promotions. Even a short window of posts can draw buyers before the account owner notices.

For Microsoft, the incident is also awkward on its own terms. The company is one of the largest vendors of identity and account-security products, and it regularly publishes research on phishing and account takeover. It has not said whether the attackers used a stolen password, a hijacked session, a compromised employee device or a third-party social media tool.

BleepingComputer's report does not say how long the posts stayed up or whether the token's price moved while they were live.

A Familiar Pattern

Microsoft has been hit this way before. In June 2024, the @MicrosoftIndia account, which had more than 211,000 followers, was hijacked to promote a fake crypto presale tied to wallet-draining malware.

The best-known case on X involved the U.S. Securities and Exchange Commission. In January 2024, attackers who had taken over a phone number through a SIM swap used the @SECGov account to announce a fake approval of bitcoin exchange-traded funds, briefly moving the bitcoin price. The man convicted in that case was later sentenced to 14 months in prison.

What to Watch

Microsoft says its investigation into the cause is continuing; watch for whether it discloses the access method and whether any other Microsoft-run accounts were affected. Also watch whether X suspends @ClippyMSFT and whether Microsoft follows through with legal action against the people behind the token, who have not been identified.